[root@iZbp13ldkm1p7rw6eb5wteZ log]# cat /var/log/secure
Mar 22 09:26:53 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: Invalid user admin from 121.239.140.210 port 20108
Mar 22 09:26:53 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: input_userauth_request: invalid user admin [preauth]
Mar 22 09:26:53 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: pam_unix(sshd:auth): check pass; user unknown
Mar 22 09:26:53 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=121.239.140.210
Mar 22 09:26:55 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: Failed password for invalid user admin from 121.239.140.210 port 20108 ssh2
Mar 22 09:26:55 iZbp13ldkm1p7rw6eb5wteZ sshd[7077]: Connection closed by 121.239.140.210 port 20108 [preauth]
Mar 22 09:26:58 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: Invalid user admin from 121.239.140.210 port 20679
Mar 22 09:26:58 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: input_userauth_request: invalid user admin [preauth]
Mar 22 09:26:58 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: pam_unix(sshd:auth): check pass; user unknown
Mar 22 09:26:58 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=121.239.140.210
Mar 22 09:27:01 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: Failed password for invalid user admin from 121.239.140.210 port 20679 ssh2
Mar 22 09:27:01 iZbp13ldkm1p7rw6eb5wteZ sshd[7079]: Connection closed by 121.239.140.210 port 20679 [preauth]
Mar 22 09:58:49 iZbp13ldkm1p7rw6eb5wteZ sshd[7108]: Did not receive identification string from 47.94.39.226 port 51776
Mar 23 04:40:53 iZbp13ldkm1p7rw6eb5wteZ sshd[8443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=191.23.172.231 user=root
Mar 23 04:40:53 iZbp13ldkm1p7rw6eb5wteZ sshd[8443]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 23 04:40:54 iZbp13ldkm1p7rw6eb5wteZ sshd[8443]: Failed password for root from 191.23.172.231 port 20691 ssh2
Mar 23 04:40:55 iZbp13ldkm1p7rw6eb5wteZ sshd[8443]: Received disconnect from 191.23.172.231 port 20691:11: Bye Bye [preauth]
Mar 23 04:40:55 iZbp13ldkm1p7rw6eb5wteZ sshd[8443]: Disconnected from 191.23.172.231 port 20691 [preauth]
Mar 23 05:26:20 iZbp13ldkm1p7rw6eb5wteZ sshd[8495]: Did not receive identification string from 64.64.20.115 port 49168
Mar 23 15:57:00 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: Invalid user admin from 176.50.228.121 port 41038
Mar 23 15:57:00 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: input_userauth_request: invalid user admin [preauth]
Mar 23 15:57:00 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 15:57:00 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=176.50.228.121
Mar 23 15:57:02 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: Failed password for invalid user admin from 176.50.228.121 port 41038 ssh2
Mar 23 15:57:03 iZbp13ldkm1p7rw6eb5wteZ sshd[9303]: Connection closed by 176.50.228.121 port 41038 [preauth]
Mar 23 15:57:16 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: Invalid user admin from 176.50.228.121 port 41065
Mar 23 15:57:16 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: input_userauth_request: invalid user admin [preauth]
Mar 23 15:57:16 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 15:57:16 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=176.50.228.121
Mar 23 15:57:18 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: Failed password for invalid user admin from 176.50.228.121 port 41065 ssh2
Mar 23 15:57:18 iZbp13ldkm1p7rw6eb5wteZ sshd[9305]: Connection closed by 176.50.228.121 port 41065 [preauth]
Mar 23 18:10:30 iZbp13ldkm1p7rw6eb5wteZ sshd[9516]: Did not receive identification string from 119.23.139.140 port 33106
Mar 25 11:21:21 iZbp13ldkm1p7rw6eb5wteZ sshd[12778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.57.160.247 user=root
Mar 25 11:21:21 iZbp13ldkm1p7rw6eb5wteZ sshd[12778]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 25 11:21:23 iZbp13ldkm1p7rw6eb5wteZ sshd[12778]: Failed password for root from 36.57.160.247 port 22207 ssh2
Mar 25 11:21:26 iZbp13ldkm1p7rw6eb5wteZ sshd[12778]: Accepted password for root from 36.57.160.247 port 22207 ssh2
Mar 25 11:21:26 iZbp13ldkm1p7rw6eb5wteZ sshd[12778]: pam_unix(sshd:session): session opened for user root by (uid=0)
[root@iZbp13ldkm1p7rw6eb5wteZ log]# tail -100f secure-20200322
Mar 19 01:06:48 iZbp13ldkm1p7rw6eb5wteZ sshd[1373]: Failed password for root from 156.67.214.64 port 42012 ssh2
Mar 19 01:06:49 iZbp13ldkm1p7rw6eb5wteZ sshd[1373]: Received disconnect from 156.67.214.64 port 42012:11: Bye Bye [preauth]
Mar 19 01:06:49 iZbp13ldkm1p7rw6eb5wteZ sshd[1373]: Disconnected from 156.67.214.64 port 42012 [preauth]
Mar 19 04:09:07 iZbp13ldkm1p7rw6eb5wteZ sshd[1607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=190.230.225.25 user=root
Mar 19 04:09:07 iZbp13ldkm1p7rw6eb5wteZ sshd[1607]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 04:09:09 iZbp13ldkm1p7rw6eb5wteZ sshd[1607]: Failed password for root from 190.230.225.25 port 8449 ssh2
Mar 19 04:09:09 iZbp13ldkm1p7rw6eb5wteZ sshd[1607]: Received disconnect from 190.230.225.25 port 8449:11: Bye Bye [preauth]
Mar 19 04:09:09 iZbp13ldkm1p7rw6eb5wteZ sshd[1607]: Disconnected from 190.230.225.25 port 8449 [preauth]
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: Invalid user pi from 71.226.38.243 port 38884
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: input_userauth_request: invalid user pi [preauth]
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: Invalid user pi from 71.226.38.243 port 38890
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: input_userauth_request: invalid user pi [preauth]
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: pam_unix(sshd:auth): check pass; user unknown
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=71.226.38.243
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: pam_unix(sshd:auth): check pass; user unknown
Mar 19 06:35:39 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=71.226.38.243
Mar 19 06:35:42 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: Failed password for invalid user pi from 71.226.38.243 port 38884 ssh2
Mar 19 06:35:42 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: Failed password for invalid user pi from 71.226.38.243 port 38890 ssh2
Mar 19 06:35:42 iZbp13ldkm1p7rw6eb5wteZ sshd[1771]: Connection closed by 71.226.38.243 port 38884 [preauth]
Mar 19 06:35:42 iZbp13ldkm1p7rw6eb5wteZ sshd[1772]: Connection closed by 71.226.38.243 port 38890 [preauth]
Mar 19 11:33:20 iZbp13ldkm1p7rw6eb5wteZ sshd[2116]: Did not receive identification string from 39.107.14.208 port 43362
Mar 19 11:55:45 iZbp13ldkm1p7rw6eb5wteZ sshd[2136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=91.248.211.12 user=root
Mar 19 11:55:45 iZbp13ldkm1p7rw6eb5wteZ sshd[2136]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 11:55:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2136]: Failed password for root from 91.248.211.12 port 28696 ssh2
Mar 19 11:55:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2136]: Received disconnect from 91.248.211.12 port 28696:11: Bye Bye [preauth]
Mar 19 11:55:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2136]: Disconnected from 91.248.211.12 port 28696 [preauth]
Mar 19 15:59:10 iZbp13ldkm1p7rw6eb5wteZ sshd[2409]: Did not receive identification string from 119.23.138.247 port 52078
Mar 19 17:24:17 iZbp13ldkm1p7rw6eb5wteZ sshd[2520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=5.88.168.246 user=root
Mar 19 17:24:17 iZbp13ldkm1p7rw6eb5wteZ sshd[2520]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:24:19 iZbp13ldkm1p7rw6eb5wteZ sshd[2520]: Failed password for root from 5.88.168.246 port 42615 ssh2
Mar 19 17:24:20 iZbp13ldkm1p7rw6eb5wteZ sshd[2520]: Received disconnect from 5.88.168.246 port 42615:11: Bye Bye [preauth]
Mar 19 17:24:20 iZbp13ldkm1p7rw6eb5wteZ sshd[2520]: Disconnected from 5.88.168.246 port 42615 [preauth]
Mar 19 17:27:45 iZbp13ldkm1p7rw6eb5wteZ sshd[2522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=81.142.80.97 user=root
Mar 19 17:27:45 iZbp13ldkm1p7rw6eb5wteZ sshd[2522]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:27:46 iZbp13ldkm1p7rw6eb5wteZ sshd[2522]: Failed password for root from 81.142.80.97 port 51728 ssh2
Mar 19 17:27:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2522]: Received disconnect from 81.142.80.97 port 51728:11: Bye Bye [preauth]
Mar 19 17:27:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2522]: Disconnected from 81.142.80.97 port 51728 [preauth]
Mar 19 17:28:51 iZbp13ldkm1p7rw6eb5wteZ sshd[2524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=178.48.64.10 user=root
Mar 19 17:28:51 iZbp13ldkm1p7rw6eb5wteZ sshd[2524]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:28:53 iZbp13ldkm1p7rw6eb5wteZ sshd[2524]: Failed password for root from 178.48.64.10 port 52198 ssh2
Mar 19 17:28:53 iZbp13ldkm1p7rw6eb5wteZ sshd[2524]: Received disconnect from 178.48.64.10 port 52198:11: Bye Bye [preauth]
Mar 19 17:28:53 iZbp13ldkm1p7rw6eb5wteZ sshd[2524]: Disconnected from 178.48.64.10 port 52198 [preauth]
Mar 19 17:37:26 iZbp13ldkm1p7rw6eb5wteZ sshd[2534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=5.88.168.246 user=root
Mar 19 17:37:26 iZbp13ldkm1p7rw6eb5wteZ sshd[2534]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:37:29 iZbp13ldkm1p7rw6eb5wteZ sshd[2534]: Failed password for root from 5.88.168.246 port 33828 ssh2
Mar 19 17:37:29 iZbp13ldkm1p7rw6eb5wteZ sshd[2534]: Received disconnect from 5.88.168.246 port 33828:11: Bye Bye [preauth]
Mar 19 17:37:29 iZbp13ldkm1p7rw6eb5wteZ sshd[2534]: Disconnected from 5.88.168.246 port 33828 [preauth]
Mar 19 17:38:18 iZbp13ldkm1p7rw6eb5wteZ sshd[2536]: Connection closed by 81.149.238.206 port 59162 [preauth]
Mar 19 17:42:34 iZbp13ldkm1p7rw6eb5wteZ sshd[2546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=5.88.168.246 user=root
Mar 19 17:42:34 iZbp13ldkm1p7rw6eb5wteZ sshd[2546]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:42:36 iZbp13ldkm1p7rw6eb5wteZ sshd[2546]: Failed password for root from 5.88.168.246 port 59044 ssh2
Mar 19 17:42:36 iZbp13ldkm1p7rw6eb5wteZ sshd[2546]: Received disconnect from 5.88.168.246 port 59044:11: Bye Bye [preauth]
Mar 19 17:42:36 iZbp13ldkm1p7rw6eb5wteZ sshd[2546]: Disconnected from 5.88.168.246 port 59044 [preauth]
Mar 19 17:47:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=5.88.168.246 user=root
Mar 19 17:47:47 iZbp13ldkm1p7rw6eb5wteZ sshd[2548]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:47:50 iZbp13ldkm1p7rw6eb5wteZ sshd[2548]: Failed password for root from 5.88.168.246 port 56027 ssh2
Mar 19 17:47:50 iZbp13ldkm1p7rw6eb5wteZ sshd[2548]: Received disconnect from 5.88.168.246 port 56027:11: Bye Bye [preauth]
Mar 19 17:47:50 iZbp13ldkm1p7rw6eb5wteZ sshd[2548]: Disconnected from 5.88.168.246 port 56027 [preauth]
Mar 19 17:52:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=5.88.168.246 user=root
Mar 19 17:52:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2562]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Mar 19 17:53:01 iZbp13ldkm1p7rw6eb5wteZ sshd[2562]: Failed password for root from 5.88.168.246 port 53017 ssh2
Mar 19 17:53:01 iZbp13ldkm1p7rw6eb5wteZ sshd[2562]: Received disconnect from 5.88.168.246 port 53017:11: Bye Bye [preauth]
Mar 19 17:53:01 iZbp13ldkm1p7rw6eb5wteZ sshd[2562]: Disconnected from 5.88.168.246 port 53017 [preauth]
Mar 19 20:25:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: Invalid user admin from 168.228.197.214 port 38239
Mar 19 20:25:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: input_userauth_request: invalid user admin [preauth]
Mar 19 20:25:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: pam_unix(sshd:auth): check pass; user unknown
Mar 19 20:25:59 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=168.228.197.214
Mar 19 20:26:01 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: Failed password for invalid user admin from 168.228.197.214 port 38239 ssh2
Mar 19 20:26:02 iZbp13ldkm1p7rw6eb5wteZ sshd[2746]: Connection closed by 168.228.197.214 port 38239 [preauth]
Mar 19 20:26:13 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: Invalid user admin from 168.228.197.214 port 38243
Mar 19 20:26:13 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: input_userauth_request: invalid user admin [preauth]
Mar 19 20:26:13 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: pam_unix(sshd:auth): check pass; user unknown
Mar 19 20:26:13 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=168.228.197.214
Mar 19 20:26:15 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: Failed password for invalid user admin from 168.228.197.214 port 38243 ssh2
Mar 19 20:26:16 iZbp13ldkm1p7rw6eb5wteZ sshd[2748]: Connection closed by 168.228.197.214 port 38243 [preauth]
Mar 20 02:53:32 iZbp13ldkm1p7rw6eb5wteZ sshd[3214]: Did not receive identification string from 101.133.138.230 port 36778
Mar 20 02:53:33 iZbp13ldkm1p7rw6eb5wteZ sshd[3215]: Did not receive identification string from 101.133.138.230 port 37920
Mar 20 04:37:19 iZbp13ldkm1p7rw6eb5wteZ sshd[3360]: Connection reset by 92.118.160.45 port 54579 [preauth]
Mar 20 15:02:24 iZbp13ldkm1p7rw6eb5wteZ sshd[4086]: Did not receive identification string from 47.96.254.10 port 40382
Mar 20 18:03:12 iZbp13ldkm1p7rw6eb5wteZ sshd[4291]: Did not receive identification string from 47.100.64.86 port 39230
Mar 21 01:54:31 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: Invalid user gi from 47.98.143.82 port 62210
Mar 21 01:54:31 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: input_userauth_request: invalid user gi [preauth]
Mar 21 01:54:31 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: pam_unix(sshd:auth): check pass; user unknown
Mar 21 01:54:31 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=47.98.143.82
Mar 21 01:54:33 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: Failed password for invalid user gi from 47.98.143.82 port 62210 ssh2
Mar 21 01:54:33 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: Received disconnect from 47.98.143.82 port 62210:11: Bye Bye [preauth]
Mar 21 01:54:33 iZbp13ldkm1p7rw6eb5wteZ sshd[4831]: Disconnected from 47.98.143.82 port 62210 [preauth]
Mar 21 02:56:42 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: Invalid user admin from 156.213.89.149 port 34548
Mar 21 02:56:42 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: input_userauth_request: invalid user admin [preauth]
Mar 21 02:56:42 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: pam_unix(sshd:auth): check pass; user unknown
Mar 21 02:56:42 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=156.213.89.149
Mar 21 02:56:44 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: Failed password for invalid user admin from 156.213.89.149 port 34548 ssh2
Mar 21 02:56:48 iZbp13ldkm1p7rw6eb5wteZ sshd[4902]: Connection closed by 156.213.89.149 port 34548 [preauth]
Mar 21 02:56:55 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: Invalid user admin from 156.213.89.149 port 34598
Mar 21 02:56:55 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: input_userauth_request: invalid user admin [preauth]
Mar 21 02:56:55 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: pam_unix(sshd:auth): check pass; user unknown
Mar 21 02:56:55 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=rhost=156.213.89.149
Mar 21 02:56:57 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: Failed password for invalid user admin from 156.213.89.149 port 34598 ssh2
Mar 21 02:56:57 iZbp13ldkm1p7rw6eb5wteZ sshd[4904]: Connection closed by 156.213.89.149 port 34598 [preauth]
Mar 21 16:53:53 iZbp13ldkm1p7rw6eb5wteZ sshd[5879]: Bad protocol version identification 'GET / HTTP/1.1' from 47.101.53.251 port 57475
^X^C
来源：https://www.cnblogs.com/nsh123/p/12565368.html